diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 0e085b3..60c9311 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -10,6 +10,11 @@ on:
 jobs:
   build-and-push:
     runs-on: docker
+    # Default auto-token permission on this instance is read-only for packages;
+    # pushing to the container registry needs write explicitly.
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@v4